mirai | 497af7336af1b2c123ccbf86f4e2cbe0a738ab963a6f38c615a1bad450acd294

Analysis

max time kernel
150s
max time network
154s
platform
debian-12_mipsel
resource
debian12-mipsel-20240418-en
resource tags

arch:mipselimage:debian12-mipsel-20240418-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
06/03/2025, 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

morte.mpsl.elf
Size

51KB
MD5

9883b0515b79f6f03cf024b4bd01dc4b
SHA1

398681098d674d115f4c66b55e089390247add1e
SHA256

497af7336af1b2c123ccbf86f4e2cbe0a738ab963a6f38c615a1bad450acd294
SHA512

d9ebc0473de2199245277378695f2cb026512546e2e2550a99e92d841ff28070de559d97f7e34ddba0e84d6bf46c7e977ca21a0823b119bdb07d5d01f3a70601
SSDEEP

768:JMpiZfkUuC1QZlN8AJT9n8UqXvONpx1UMtrqzFwz5bNU7l5I0W6:JMOkj2QjJpn8VXipx1U3JwJNUJ

Score

10^/10

mirai botnet defense_evasion discovery

Malware Config

Signatures

Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai
Mirai family
mirai
Contacts a large (23892) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	morte.mpsl.elf
File opened for modification	/dev/misc/watchdog	morte.mpsl.elf

/tmp/morte.mpsl.elf
/tmp/morte.mpsl.elf
1⤵
- Modifies Watchdog functionality
PID:742

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...